WordPress Multiple Vulnerabilities

Multiple vulnerabilities were identified in WordPress. A remote attacker could exploit some of these vulnerabilities to trigger remote code execution,  sensitive information disclosure and data manipulation on the targeted system.

Note:

Proof-of-concept code is publicly available for CVE-2026-63030 and CVE-2026-60137. Attacker can be chained together to achieve pre-authentication remote code execution against WordPress installs running versions 6.9.x and 7.0.x.